CHINA Law and Practice Contributed by: Jihong Chen, Zhong Lun Law Firm
in China is complex but complementary. The DSL establishes uniform baseline security management requirements for all types of data, including both per - sonal and non-personal data. The CSL serves as the fundamental law for cyberspace governance and is designed to protect network operation security, net - work information security, and PI involved in network operations. With regard to AI-related laws, on one hand, the essential data protection laws (including the Three Fundamental Laws and the Four Key Regula - tions) are applicable to all data processing activities under AI-related scenarios. On the other hand, the AI-related laws specify and complement the data pro - tection requirements in the context of AI. Together, the PI protection laws and other laws gov - erning non-personal data, cyber and AI provide a comprehensive approach to ensure cybersecurity and promote data and privacy protection. The above legal frameworks collectively address different aspects of data handling in China. However, they share unified objectives of enhancing cyber and data security and ensuring accountability in the digital age. 1.2 Rights and Obligations General Principles and Requirements The core principles for processing PI established by the PIPL include the following: • legality, legitimacy, necessity and good faith; • purpose limitation and data minimisation; • transparency; • data accuracy; and • accountability. Under these principles, the PIPL sets forth a series of specific compliance requirements, including obliga - tions to notify data subjects, obtain appropriate legal bases, implement PI security safeguards and incident response measures, as well as to fulfil specific obli - gations regarding cross-border data transfer (CBDT). Data Subjects’ Rights The PIPL provides PI subjects with the right, in relation to their data, to know, decide, restrict, refuse, access, copy, make portable, rectify, delete, and withdraw their consent. In addition, PI subjects are also provid - ed with related rights on automated decision-making.
The right to data portability states that where PI sub - jects request to transfer their PI to another designated PI handler, such request shall be fulfilled by PI han - dlers when prescribed conditions are met. Main Compliance Requirements for Organisations To ensure compliance with the requirements of the PIPL, organisations should implement, at a minimum, the following compliance measures. • Conduct data mapping due diligence of PI pro - cessing activities; identify whether the obligation to inform data subjects has been fulfilled and appro - priate legal bases have been obtained. Identify CBDT scenarios and evaluate whether the corre - sponding obligations have been fulfilled. • Carry out classified and graded management of PI. • Establish internal management policies and opera - tional procedures. • Implement appropriate technical security meas - ures. • Formulate and implement emergency response plan. Take remedial action and make necessary reports in the event of a PI breach. • Designate a PI protection officer to ensure the legal threshold is met. • Conduct PI compliance audits. • Perform a PI Protection Impact Assessment (PIPIA) prior to engaging in specific processing activities. 1.3 Special Categories of Personal Data Under the PIPL, PI that is likely to result in damage to the personal dignity of any natural person or damage to their personal or property safety once disclosed or illegally used, including such information as biometric identification, religious belief, specific identity, medical health, financial account and whereabouts and tracks, as well as the PI of minors under the age of 14, is defined as sensitive PI. Compared to general PI, sensitive PI is subject to more stringent protection requirements. It may be pro - cessed only for a specific purpose, where sufficiently necessary, and after strict protection measures have been taken. According to Article 28 of the PIPL and the GB/T 45574-2025 Security Requirements for Sensitive Per -
50 CHAMBERS.COM
Powered by FlippingBook